Digital Rights Management For Media Streams

1. A method comprising: encrypting, by a licensing server, using a public key of a public/private key pair and an asymmetric-key algorithm, a root license that includes a root key; encrypting, using the root key and a first symmetric-key algorithm, a media-stream license that includes a symmetric media-stream key; encrypting, using the symmetric media-stream key and a second symmetric-key algorithm, a leaf license that includes a content key, the leaf license provided in-band with content provided to a computing device; providing, by the licensing server and prior to providing content encrypted with the content key, the root license, the media-stream license, and the leaf license, the providing effective to enable the computing device having a private key of the public/private key pair and the content encrypted with the content key to decrypt the content; repeating the act of encrypting the root license after a first period, repeating the act of encrypting the media-stream license after a second period, and repeating the act of encrypting the leaf license after a third period, the first period longer than the second period, the second period longer than the third period; and limiting a loss of the decrypted content due to a single cryptographic compromise of one of the root license, the media-stream license, or the leaf license, the loss limited to an amount of the decrypted content lasting two times the second period.

2. The method as recited in claim 1 , wherein the root license includes a root policy associated with a user, the media-stream license includes a media-stream policy associated with a media stream, and the leaf license includes a leaf policy associated with the content.

3. The method as recited in claim 1 , wherein the root key is used to encrypt multiple symmetric media-stream keys, each of the multiple symmetric media-stream keys associated with one of multiple media-stream licenses, each of the multiple media-stream licenses associated with one of multiple television channels.

4. The method as recited in claim 3 , wherein each of the multiple media-stream licenses contains one of the multiple symmetric media-stream keys, the one of the multiple symmetric media-stream keys encrypted by the root key and used to encrypt multiple content keys, each of the multiple content keys associated with one of multiple content of one of the multiple television channels to which the each of the multiple media-stream licenses is associated.

5. The method as recited in claim 1 , further comprising performing the act of encrypting the root license multiple times for multiple users, each of the multiple users requiring a different root key but same symmetric media-stream keys and same content keys.

6. The method as recited in claim 1 , further comprising encrypting unencrypted content to provide the content, the act of encrypting unencrypted content using the content key.

7. The method as recited in claim 6 , further comprising providing the content to the computing device.

8. The method as recited in claim 1 , wherein the act of providing the root license, the media-stream license, and the leaf license provides the root license and the media-stream license prior to or at the same time as providing the leaf license.

9. A method comprising: receiving, by a computing device, a root license encrypted using a public key of a public/private key pair and including a root key; receiving a media-stream license encrypted using the root key and including a symmetric media-stream key; receiving a leaf license, in-band with content, having a content key, the leaf license encrypted using the symmetric media-stream key; receiving the content encrypted using the content key and prior to receiving the root license, the media-stream license, and the leaf license; decrypting, by the computing device, the root license using a private key of the public/private key pair to determine the root key; decrypting the media-stream license using the root key to determine the symmetric media-stream key; decrypting the leaf license using the symmetric media-stream key to determine the content key; decrypting the content using the content key to provide decrypted content; and repeating the acts of receiving the root license and decrypting the root license after a first period, repeating the acts of receiving and decrypting the media-stream license after a second period, and repeating the acts of receiving and decrypting the leaf license after a third period; and limiting a loss of the decrypted content due to a single cryptographic compromise of one of the root license, the media-stream license, or the leaf license, the loss limited to an amount of the decrypted content lasting two times the second period.

10. The method as recited in claim 9 , further comprising providing the public key, the public key associated with the computing device or a user of the computing device.

11. The method as recited in claim 10 , wherein the act of providing provides the public key to a remote entity capable of providing the root license, and wherein the acts of receiving the root license, receiving the media-stream license, and receiving the leaf license receive from the remote entity.

12. The method as recited in claim 9 , wherein the root key is used to encrypt multiple symmetric media-stream keys, each of the multiple symmetric media-stream keys associated with one of multiple media-stream licenses, each of the multiple media-stream licenses governing use of one of multiple television channels, and the act of decrypting the media-stream license decrypts multiple media-stream licenses to determine the multiple symmetric media-stream keys.

13. The method as recited in claim 9 , wherein the media-stream key is used to encrypt multiple content keys, each of the multiple content keys associated with one of multiple leaf licenses, each of the multiple leaf licenses governing use of one block of content of multiple blocks of content.

14. The method as recited in claim 9 , wherein the computing device is a set-top box, laptop computer, desktop computer, handheld computer, or cellular phone.

15. The method as recited in claim 9 , wherein the acts of decrypting the root license and decrypting the media-stream license are performed prior to or at the same time as receiving the leaf license.

16. The method as recited in claim 15 , further comprising rendering the content after the act of decrypting the content, and wherein the acts of decrypting the content and rendering the content are performed without causing a perceptible delay to a user between the tuning to the television channel and the rendering of the content.